Job Search

As an Internal Red Team Consultant, you will help assess and strengthen the security of critical systems, applications, infrastructure and business processes. Working as part of a collaborative security function, you will plan and deliver authorised red team exercises, penetration tests and adversary simulations that reflect realistic threats. You will identify weaknesses across people, processes and technology, safely demonstrate potential business impact, and provide clear, practical recommendations that support measurable risk reduction.

Your responsibilities will include defining assessment objectives and scopes, developing attack paths, conducting reconnaissance, exploiting vulnerabilities within agreed rules of engagement, and documenting evidence to a professional standard. You will work across cloud, on-premises and hybrid environments, with opportunities to assess web applications, APIs, networks, endpoints, identity platforms and physical or social engineering controls where appropriate. You will communicate findings to both technical and non-technical audiences, produce concise reports, brief stakeholders on risk and remediation priorities, and help validate that corrective actions have been implemented effectively.

The successful candidate will have proven experience in red teaming, penetration testing, security assessment or a closely related discipline, with strong practical knowledge of common attack techniques, defensive controls and threat actor behaviour. Experience with Active Directory, cloud security, web technologies, scripting or programming, and tools used for reconnaissance, exploitation and command-and-control is desirable. You should be comfortable working independently, challenging assumptions constructively and managing multiple engagements while maintaining confidentiality and professional integrity. Relevant industry certifications or equivalent hands-on experience are welcome. Excellent written and verbal communication skills are essential, as is the ability to translate technical findings into clear business risk and actionable improvements.

We are seeking a Senior Staff Security Engineer, AI Security, to help define and advance security strategy for artificial intelligence and machine learning systems. This role will lead the design of secure-by-default architectures, protections, and engineering practices across the AI lifecycle, from data ingestion and model development through deployment, monitoring, and retirement. You will work closely with research, product, infrastructure, privacy, legal, and incident response teams to identify emerging threats and translate them into practical controls that enable responsible innovation.

You will conduct threat modelling and security reviews for AI platforms, model-serving infrastructure, agents, APIs, and supporting services; develop mitigations for risks such as prompt injection, data poisoning, model extraction, insecure tool use, supply-chain compromise, and sensitive information disclosure; and establish standards for authentication, authorisation, isolation, secrets management, logging, abuse prevention, and resilience. Responsibilities will also include designing evaluation and red-team programmes, improving detection and response capabilities, investigating complex security incidents, contributing to security architecture reviews, and mentoring engineers. You will influence technical roadmaps, communicate risk to senior stakeholders, and represent AI security principles across the wider engineering organisation.

The successful candidate will bring significant experience in security engineering, application security, cloud infrastructure, platform security, or a related discipline, along with a strong understanding of machine learning systems and their threat landscape. Experience securing generative AI applications, large language models, agentic workflows, model pipelines, or high-scale distributed systems is highly desirable. You should be comfortable writing production-quality code and automation, analysing complex systems, and turning ambiguous problems into clear, measurable programmes of work. Strong knowledge of security principles, threat modelling methodologies, vulnerability management, and incident response is expected. Excellent written and verbal communication, sound judgement, and the ability to influence without direct authority are essential. A degree in computer science, cybersecurity, or a comparable technical field—or equivalent practical experience—is preferred.